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CONFIDENTIALITY 


The information in this document is confidential and shall not be disclosed to any 


third party in whole or in part without the prior written consent of Atos Worldline 
S.A./N.V. 





COPYRIGHT 


The information in this document is subject to change without notice and shall not 
be construed as a commitment by Atos Worldline S.A./N.V. 

The content of this document, including but not limited to trademarks, designs, 
logos, text, images, is the property of Atos Worldline S.A/N.V. and is protected by 
the Belgian Act of 30.06.1994 related to author’s right and by the other applicable 
Acts. 

The contents of this document must not be reproduced in any form whatsoever, by or 
on behalf of third parties, without the prior written consent of Atos Worldline 
S.A./N.V. 

Except with respect to the limited license to download and print certain material 
from this document for non-commercial and personal use only, nothing contained in 
this document shall grant any license or right to use any of Atos Worldline 
S.A./N.V.’s proprietary material. 





LEGAL DISCLAIMER 


While Atos Worldline S.A./N.V. has made every attempt to ensure that the 
information contained in this document 1s correct, Atos Worldline S.A./N.V. does 
not provide any legal or commercial warranty on the document that is described in 
this specification. The technology is thus provided “as is” without warranties of any 
kind, expressed or implied, included those of merchantability and fitness for a 
particular purpose. Atos Worldline S.A./N.V. does not warrant or assume any legal 
liability or responsibility for the accuracy, completeness, or usefulness of any 
information, product or process disclosed. 

To the fullest extent permitted under applicable law, neither Atos Worldline 
S.A./N.V. nor its affiliates, directors, employees and agents shall be liable to any 
party for any damages that might result from the use of the technology as described 
in this document (including without limitation direct, indirect, incidental, special, 
consequential and punitive damages, lost profits). 





JURISDICTION AND APPLICABLE LAW 


These terms shall be governed by and construed in accordance with the laws of 


Belgium. You irrevocably consent to the jurisdiction of the courts located in Brussels 
for any action arising from or related to the use of this document. 





sa Atos Worldline nv — Chaussée de Haecht 1442 Haachtsesteenweg 
B-1130 Bruxelles-Brussel - Belgium 
RPM-RPR Bruxelles-Brussel - TVA-BTW BE 0418.547.872 
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1. SCOPE OF THE DOCUMENT 


This document describes how to generate RSA keys (RSA Key Pair and RSA Public 
Key) using the RSA Key Generation program. 


The document doesn’t explain the functionalities of the DEP libraries on which this 
program is based. 


1.1. REFERENCES 


This document contains references to other documents about the DEP. This paragraph 
gives a list of all the documents referred to: 


e DEP Host Interface Protocol 
e DEP/NMS User Manual 

e DEP/Linux User Manual 

e DEP/T6 Owner Manual 


There are no references made to the following documents, but they could be useful to 
understand this document: 


PKI Library for DEP - Reference DFS Manual 
DEP Introduction to DEP 

DEP General Architecture 

DEP Glossary 


1.2. CONTACTING ATOS WORLDLINE 


You can visit Atos Worldline on the World Wide Web to find out about new products 
and about various other fields of interest. 
URL: www.atosworldline.com. 


For the documentation visit http://www.banksys.com web page. 


For support on issues related to DEP, customers, partners, resellers, and distributors 
can send an email to the DEP Hotline: 


mailto:dephotline-atosworldline @ atosorigin.com. 
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2. PURPOSE OF RSA KEY GENERATION 


PROGRAM 





The purpose of this program is to generate RSA Keys (RSA Key Pair and RSA Public 
Key) and write it in specific files. 


The program is intended to be used on a PC (running on Microsoft Windows 2000, 
Windows 2000 and Windows Vista) that 1s connected to a DEP Platform (DEP/T6) 
loaded with a DEP Application Software that can generate and export RSA Keys. It 
also can be added as a plug-in in DEP/NMS application. 


3. USE OF RSA KEY GENERATION 





The installation procedure is reported to the AnnexA on page 14. 


3.1. PREREQUISITES 


e The DEP Crypto Module must be unlocked; 

e A valid DEP Application Software should be loaded on DEP Crypto Module; 

e A DEP Application Software that supports the generation and export of RSA 
Keys should be loaded on DEP Crypto Module; 

e The K_PKI_RSA_TRANSPORT_KEY or the K_PKI_RSA_ TK _AES 
transport key should be loaded in DEP Crypto Module depending on the 
export method to be chosen (DES or AES); 

e To use the RSA Key Generation application as a DEP/NMS plug-in, the USB 


License Dongle must be present. 


3.2. START-UP 


The RSA Key Generation can be launched by executing: 


C:\Program Files\Atos Worldline\DEP_NMS_PlugIns\RSA Key 
Generation\RSA_KeyGeneration.exe 


This is the default path. It is possible to define another path during installation 
(paragraph 4 on page 14). 


The application can also be launched directly through the DEP/NMS. Select the 
appropriate DEP Crypto Module and run the RSA_KeyGeneration plug-in from the 
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Plug Ins menu. 





: = DEP/NMS C:',192.168.0.19.chg 


Filé Edit View DEP Platform DEP Crypto Module Tools | PlugIns Help 


cha ew wie 2 BAY | AddPuglr.., 


Organize Plug Ins... 











Platform s¥mbolic name Security | Platform status | Tr 
— [2] 192.168.0.19.cfg MCR SelFSignedCertificate 
— (i) 192,168.0.172 wt Unlocked R54 _KeyImportIinkeytable 


ier) 


4 Module 2 CTAP_CertificateGeneration 
R54, KevGeneration 





Before starting the application, the communication must be defined. (See paragraph 
3.3 on page 7). 


3.3. DESCRIPTION 


Once the RSA Key Generation program is started, the following window is opened: 


—0 RSA Key Generation =15) x| 
File Help 
IMpu Outpu 





lntetace to use for the generatia 
f |_PRIL_GENERATE_ASA_KEY 
f | PKLGENERATE_ASA_KEY 9.31 


Public Exponent: [Decimal Value] 
Key Length in Bits: [Decimal Value] 


Export metho 


Export using DES Transport Rey 


f Export using 4ES Transport Key 
Instance Byte: O00 (O0' by default) 


Output Directory: Browse... | 


Generate ASA Key | 





DEP Platform 192,168,0.18 - Not Connected DEP Crypto Module number 02 





A menu at the top of the window allows to have a look at the program version (and 
also contact the DEP Hotline), the help files or to exit. 

The /nput section contains the list of parameters needed to generate an RSA Key (see 
paragraph 3.4 on page 8). The Output section (blank part) will log the operations and 
their results. 


3.4. COMMUNICATION 


If the application is launched by the DEP/NMS, the communication is automatically 
set by the DEP/NMS program. 
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If the application is used as stand-alone application, the user should set the general 
parameters and the connection settings in the RSA_KeyGeneration.ini configuration 
file. 


#) ASA_KeyGeneration.ini - Notepad /@[ml Ea 





Filé Edit Format Help 


[GeneralParameters | 
NbofDesiredConnections=1 
[Connection 6] 
Address=172 24.74.2449 
Port=16886 

Timeout=18 6066 


TimeoutConnection=5 608 


MHodule=8181 
LSBMSEmode=L36 
LSBMSBLength=4 
DEPHagicNumber=FE 
DEPVersionNumber=34 





e NbOfDesiredConnections must be set to ‘1’. 

e Address represents the IP address of the target DEP platform. 

e Port represents the TCP/IP port used for the communication with the DEP 
platform. 

e TimeOut represents the maximum waiting time in milliseconds for the 
response from the DEP Crypto Module. 

e TimeOutConnection represents the maximum waiting time in milliseconds for 
establishing a connection. 

e Module represents the DEP Crypto Module used to generate the RSA Key: the 
first byte will be always ‘Ol’ and the second byte defines the target module: 
‘Ol’ to *04’. 

e The four last parameters are described in the DEP Documentation (DEP Host 
Interface Protocol) 


3.5. HOW TO GENERATE AN RSA KEY 


All the fields of the left panel must be filled. 
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gg  — Preips 
File Help 


Inpu 


Inteface to use for the generation 
f~ |_PKILGENERATE_ASA_KEY 
f | PEILGENERATE_RASA_KEY 3.31 
Public Exponent: [E5537 (Decimal Value] 


Key Length in Bits: 2046 (Decimal Value] 





Validation of input data... 
Validation of input data succeeded. 


Send call to the DEP Cropto Module 
Receive answer from the OEP Crypto Module 
Valid answer recerved, 


Export metho 


f Export using DES Transport Rey 


& Export using SES Transport Key 
Instance Byte: 00 (O0' by default] 


Output Directory: Ds Browse... | 


Log file created with the content of this window: 
ial OODBSS 3? .200907 201 221 487 34. tet 





ae 
Generate ASA Key | 


DEP Platform 192,168,.0,19 - Not Connected DEP Crypto Module number 01 





Field Name | Length 


Public Public exponent for the RSA Key to 
Exponent generate. The maximum value is 
4294967295 (=FRFFFFFFFhex). 


Instance Byte Instance of AES transport key to be 


used in export 


Output 
Directory 


Existing directory in which the RSA 
key files will be stored. 





Key Length | 2 Length of the RSA Key to generate n4 
in Bits (value max 4096 depending on the 

hardware of the DEP Crypto 

Module). 


User must select interface to be used for RSA _ Key generation. If 
I_PKI_GENERATE_RSA_KEY interface is selected, the standard way of RSA key 
generation will be used. If ILPKI_GENERATE_RSA_KEY_X9.31 interface is 
selected, the ANSI X.9.31 specification-based RSA key generation way will be used. 


Note: The private part of the RSA key generated is encrypted 
before export. 


User must select the exporting method to be used for export of the RSA Key 
generated. If ‘Export using DES Transport key’ is selected, then the private part of the 
RSA key generated will be encrypted by using DES transport key. If ‘Export using 
AES Transport key’ is selected, then the private part of generated RSA key will be 
encrypted by using the appropriate instance of AES transport key. 


When the user clicks the Generate RSA Key the TCP/IP connection to the DEP 
Crypto Module is established and the key is generated. 
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The right panel shows the progress of the generation: 


The validation of the input data, 

The status of the call sent to the DEP Crypto Module, 

The modulus of the RSA key generated, 

The name of the files generated by the application (.RSA, .PUB), 
The name of the log file, 

The eventual errors. 


Below are shown the structures of three generated files. 


1. The “.RSA” file contains the entire RSA Key Pair. (The Private part of the 


key 1s encrypted). 
#7) 2006081 7082746734.RS5A - Notepad | _ | 


File Edit Format Help 


Datim=17/88/2066 88:27 246 

[Crypto] 

inlen=2 648 

[n=B2661D0581 490106 627B1752BASD OBSC36F 6489DB 894 7D1CDFE7FF O7D82C7AGCE 16898 861BC68342D400C4R38E318 
IDOBCESCB?7258A1E259BECB3E9882 9C5C8EE 6189987 1BE1B7441F6E69145EE9 GALE G69 GABBB O43 406923 1D26A92437F 64D 
1ED1231D 83137 45DF82E61590911DD6EC93B2 OF 6EF SB 6E374AF6 ODFE196ADF827F5AB48486CC6D7A121D1C893S5D9B8AA9 
IFBSSDF94F 1 OF 7343945618 688E445C2E39F 82233327 4B SC DAE 18 OBC88A4A7 9CES 988176051 9ADDE?2 8032567 38F 2582DEDD 
E98 41F GCABSAF 9D? GD6ECB6FBR2766E9 02B3B39735D1F $246 G6C BCESBEG61E10798996A4S5A5 FEDB26AS39719215 B9ATG 
|5 SBEAF ASE 11348366 BES6CCSAD B6ADSZASE2Z 24S 

je=65537 

jenckey=64CF 8 66061 6881 661 456E68A4AB93 1013065 149EC2 OBSA63F 68DER99ES5 82 6681 4283 Bb67 a2 ATE SBS 3595384 
|GG68CB GFEBEFS SFAE 78185 61 86B2661DC58149A1N6 627B1752BA3D OBSC36F 6489DB 691 7D1CDFE7FF O7D82C7AGCE1B89 
IS HBT BCO8 S42 DS BBCABSBESTEDOBCESCBR 258 ATESSOBECKSES8S29CSCREE B1B99B 7 1BE1B/4S41F6E6914EE9 BAEG69 BABB 
IB O83 4069231026092 45397 F640E012310 83137 SDF 82E 61590911D06EC9982 SF é6EF SB E37 SAF 6 BDFETS6ADF S27 FS ABYSS 48 
}6CC6D70A121D108935D9B8AA9FRSSDFOAF 1 OF 73439461 B6SSES45C2E3F 8223332 4B 3CDAE 18 BBCSBA4A7 9CES9RB1 6054 
PADDE2ZOD3256738F 2582DEDDE 9S 41F GC IBAAF 9D? GDGECBOFB2 76 GE 9 826838997350 1F 8246 G60 BOCES BEGG TE IC 798 996R4 
DAS FEDB2Z6A339719215 090765 BREAFASE1T13 488E6 BES6CCSAD B6AD SZ AGES 2Z 4986 8689 81 66618 7 81 B6S9S6D8FCR11128 
ODF SACHZC COB SC 4E4366 63396049 87 FF AZASC SD BSB Y48E? 654096 B8CERFBCOFDBCD2 73927898 ODBASZ95C227E18 65240) 
IFE663B 4468372982 A026 46445 8C64FF 4016 2A5DE638619 0037F8321D5BREF3 0601469 G48DE GDADIATASACSIEE72F32 65 
SAT OCSACS TAECDEES64SEFS1391012F A870 FESS BI ZEFBBFEZ9 FDO SASD9R SSS B49F 7 PSF OTSSRF YASS DSES7OC9SF FBOAICIAS 
ISCEATZFESS BSF OSE B659F 10450023 6B8B5 862859F 9 806536758 BEESSASSEF G6S3ER76E61E 396927) A468 A247 Abb PDSBAE 
IBF O2CBFE15 7565 66 7BAE?7 PC38 998 79F 706 B1DC1F BAT oe oo oS FZEBAFBSAB (oO SFASBSCOCS4ES 833906 B690362 76129 OFF 
AHOTFESBSD BE FF OC 6SEBD1 B86 868 B60 BF BS FOCSESS 6399 AS 6CB CSB BS627F SEF DBFSBECSSACHGSSCE91ISCC O15 6EFFSACES 
AESDF BF SS ACAC9 6427F B6E 6690 BBASSDDSC BBS87 OB91D BSESS5AG8A1T GOED ZESC O62 191 7ESACCS220F FS 67558 BEFESED 
81737621822 f SES8CSARB17ASFC OF S923 FO b62A9SD ESF AF 3E1TZAFIDSS 69005 651661 7COASBB/B6DCBEFA6GAITSSBCSAC #6 
(89008 GA785AF9CSATAFCS29F 35 4DE4S3F 501154548 6FC /CADS3D6B61F 105 FADBS BD6AS 4A BAZCOAZSESSEBSG183/DFFC9A 
7 SEFB172456917 6102 GAR14ASS2816F 61 GDB GADEF BAT? 9E181D432E CA? CEC IF BDF SFESB211A9BCFESSES6 BSF 22DE618 
JEDS351F 568 BBEDASA? BSFC3B65339D FAGG2ZABSESSS3BS /ASSTESSFIECTSFAIS31394 096 BBSA B88 B2ACF 35/7 G6 SBESFB16 
|D7C7ESOBCBDD33298 7 92 BB48DA86CE 996 9BBA2SSF 7ESSCBC?7 71 OB769335CB87D EBS 781 G7 850 OBSD1SSOSE FE S4OAGG 
[G5 TA4BGE G4B 16718 D423 16E O18F GE6D691562769EE 9A GBT GAAASS 3499713 96A9883F BE GDF AS832FE GBCAE /SBAFBDAA 
IDSSB55BC 615261013 G4ASBSFFES DB 47 SF D162C6FA68 7914686 868 67 16AFASES 793 CAFBESSSES2196E8CSFDSD9CIS6CS 
IP COABSD6912CO6A7FEDFSFSD GDBS BS6DB 47098 1A8385 207091011019 D6 BES 7045965717 A41820 B6SBC581059 853A4F 
7 B9ATFRE6GSECSFBFAGITEFZ372DB894AF AZ fDS21BES FTE F25CABC? B77 PF IBF6OBC8ESCI GF OS 7SFESESSE6GDG4S B6ABBD224 
M613 87707 OC FACS? SADAZD1B14S8SC B68 607827038 48160076 418 FEBS ASS 8 2D6B2 1B 68 78880 B6S9CCIESSADFSIDZSBSD 
FB96154002CEEERF B92 10502799 676646 67 F 62 opp oo oF 66993150 46 495910 6A6AS6 BEF 1622F6CAR192EFS1ECS 
9023124) BEDCGEC BAZ 6F 87 1H4E2SSDSDSBEA BDCIFCB1BCS B6CCES2FAAFFDSS38F CCS 61 FSESCAABSCEEAS 75 ODF9BE9431 
joy? 





2. The “.PUB” file contains only the Public Part of the RSA Key. 
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7) 2006081 7082746734.PUB - Notepad | | C| 
File Edit Format Help 


[Infos] 

Version= 

Datim=17/68/20606 88:27 246 

[Crypto] 

nlen=2 648 

n=B2661D0581498A106 62 7617526BASD BB8C36F 6458908 691 7D1CDFESFFO/DS2CSAGCEIBS9S BOT BCé68S 42D 460C4BS8ES18 
DOBCESCR FASS ATEZSIRECR SES BS 2 OCSCREE BIBS9BSIBE1B 7 e411 Fb6E 691 SEE? BAE G69 BABB O4S 4069279 10D26A92 49 7F 64D 


ED123108313 74DF 8266159091 1DD6EC9SB2 GF GEF SB GES 74SAF6 ODFE196ADF 82 fFSABSSS86CCEHD/A12Z1DICS9SSD9BSAAD 
FBSS8DF94F 1 6F fS43946 1 B68 8 E445 CPE SF R22 9552 4RB30C0AE 18 BBCSS ASA ZOCES 9361 F 6051 9ADDE? ODS256/738F2582DEDD 
E9841F QCIBSAF 9D? BDGECBOGF BR? 76869 B2B3B39 7350 1F 8246 G80 CES BEGGTE IC 7989 96ASSASFEDBZGAS39 719215 09A 76 
SBE EAFASE1134588E66 BES6CCSAD B6GADSAASE2 243 

e=o55s/ 





3. The “.LOG” file contains the text present in the output memo. 


i) 2006081 7082746734.txt - Notepad _|O) 
File Edit Format Help 


Malidation of input data... 
Validation of input data succeeded. 


Key Length: 2648 bits. 
Public Exponent: 65537 


send call to the DEP Crypto Hodule 
Receive answer from the DEP Crypto Module 
Valid answer received. 


B2661D058149A106 62 #B1752BASD BB8CS6F 648908 691 FDICDFE FFF A/D82C FAGCE TBS 98 BAT BCS 3 42D 4 HOC 4BSRES18D9 
BCESCE/258A1E259BECRSE9S829CS CREE BIB99RS1BEIB/4S41F6E6914EE9 BAE 669 BABBB B4S4C69291D26A92 45 7F64DED 
123106313 740F 826 6159097 1D06EC9362 GF6EF SE GES 7 SAF GBDFE196ADF 82 /FSABSS4SS6CCOD FAIZ 1D IC89SSD9RSAASFE 
SSDFOSF 1B FS4S9 46 1BGRRERASCOESF E2293 32 4R39CDAE 18 BBC SASA/9CES SRB 17605 19ADDEZ ODS256738F 2582DEDDE9 
S41F OCIBSAF OD 7 ODGECRGFBR2 76069 8263699 795D1F 8246 G80 ACES BE661E 10798996 A455A5 FEDB26ASS9 719215 09A7658 
SEAFASE113466E66 BESGCCSAD BGADS2ZASE2Z 243 





3.6. ERRORS DURING EXECUTION 


3.6.1. Validation of input data 


Before sending the call to the DEP Crypto Module some verifications are made and 
friendly messages are displayed. 


For example: 





Error 





€3 Please enter a valid integer value in the feld “Public Exponent”. 





Selecting the OK button sets the focus to the erroneous field for correction. 
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3.6.2. Validation of the DEP Crypto Module 


After the input validation, the application performs a DEP Crypto Module validation. 
The following conditions will be checked: 


If the DEP Crypto Module is on-line/unlocked; 

If the DEP Crypto Module contains a valid DEP Application Software; 

If the DEP Application Software is able to generate and export RSA Keys; 

If the K_PKI_RSA TRANSPORT_KEY (DES transport key) or the 
K_PKI_RSA_TK_AKES (AES transport key) key is loaded in the DEP Crypto 
Module. 


If one of the verifications failed, a warning window is displayed: 


—O Warning | 





AN The DEP Crypto Module doesn't contain the key BPEL ASA TRANSPORT FEY (04250000). Please load the key. 





All warning windows disappear automatically when the problem is solved. For 
example: when the correct key is loaded or when the DEP Crypto Module is set on- 
line/unlocked. 


AN The DEP Crypto Module it in OFF LINE “LOCKED mode, Please select ON LINE“UNLOCE. mode. 





The user can also click on the OK button, solve the problem and click again on 
Generate RSA Key button. 


3.6.3. Error code from the DEP Crypto Module 


After all verifications are done successfully, a call is sent to the DEP Crypto Module. 
When no problem occurs the RSA Key is generated, otherwise an error message 1s 
returned. 


For example: 


Waning eee x 


i) The value of the Field “Key Length" must be between 1024 and 4096, 
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If ANSI X.9.31 specification based RSA key generation is executed on DEP Crypto 
Module which is not supporting it, the following error message 1s returned: 


—“‘“_OCS 


FOO2252E0003003_0001 
The required operation is nok supported by the cryptographic chip integrated in the DEP crypto module, 
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4. ANNEX A: INSTALLATION PROCEDURE 





An installation procedure exists for the RSA Key Generation program. It is a wizard- 
driven procedure that lets you to install the RSA Key Generation program. 
To begin the installation wizard, execute the setup.exe. 


iz RSA Key Generation - InstallShield Wizard 


Welcome to the InstallShield Wizard for RSA 
Key Generation 


The InskallShield( Ri Wizard will install R54 Key Generation on 
wour computer, To continue, click Wext, 


WORAIWG: This program is protected by copyright law and 
international treaties, 


E Cancel | 





Click Next to continue. 


Read and accept the License Agreement. 
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ie RSA Key Generation - InstallShield Wizard 










License Agreement 







Please read the Following license agreement carefully, 






COMFIDENTIALIT ¥ 
The information in this software is confidential and shall not be disclosed to 
any third party in whole or in part without the prior written cansent of Atas 
VWorldline S.4./N 4. 

COPYRIGHT 

The information in this software is subject to change without notice and shall 
not be construed as a commitment by Atos Y¥orldline S.A JAY. 

The content of this software, Including but not limited to trademarks, designs, 
logos, text, Images, Is the property of Atos YYorldline SAN.) and is 
protected by the Belgian Act of 3U.06.1994 related to author's right and by the >| 













( Tdo not accept the terms in the license agreement 


< Back cancel | 


Installshield 





Click Next to continue. 


The Destination Folder window allows defining the path where the application is 
installed. It 1s recommended to use the default path, yet you can specify a different 
folder by clicking Change... and selecting the desired folder for the installation. 


iz RSA Key Generation - InstallShield Wizard ; X| 


Destination Folder 










Click Next to install to this Folder, or click Change to install to a different Folder, © 








Install RS4 Key Generation to: 
Program Filesi4tos vWorldine\DEP_NMS PluginsiR54 key Change... | 
Generation) = 
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Click the Next button. 


Click the Install button to start an installation process. If you want to return to the 
previous screen, press Back or if you want to abort the procedure, click Cancel. 


ji RSA Key Generation - InstallShield Wizard 










Ready to Install the Program 


The Wizard is ready to begin installation, 














TF you wank to review or change any of your installation settings, click Back, Click Cancel to 
exit the wizard, 


Current Settings: 





Setup Type: 


Destination Folder: 
C:\Program Files 4tos Worldline DEP_NMS_ PluginsiR54 Key Generation, 


User Information: 
Name: LISER 


Company: 


Installshield 


Cancel | 


Once you have confirmed the installation options, the actual installation starts. 





Click Finish to exit the installation procedure. 
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iis RSA Key Generation - InstallShield Wizard 


InstallShield Wizard Completed 


The InstallShield Wizard has successfully installed R54 Key 
Generation. Click Finish to exit the wizard, 
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5S. ANNEX B: NOTATIONS 


The following abbreviations are used in this document. 


Numeric 
Hexadecimal 


